iiinova — where your digital self keeps evolving

Oh, and then try to get people to manually enter PAN+CVV for a CNP (Card Not Present) transaction? If people pay with Apple Pay or something like it, then it also isn't replayable card data and processing it reveals thief's identity. But I'm sure some people will enter their PAN+CVV, some will not.

000

How exactly would that work and what card or payment data would it compromise? Even with offline auth (not used in the US, but used in other countries), there really isn't anything that can be done with the cryptograms. You can only send them to issuer/acquirer as a merchant and then you are busted.

100

There are various PCI PTS compliance aspects around the reported version string and requirements for a delta review on changes to anything within the security perimeter. The version string often refers to the functionality within that perimeter, which may not have been where vuln was or was fixed.

000

Android-based PAX POS vulnerabilities (Part 1) - STM Cyber Blog

Here is an example of various compromises of an Android-based Point-of-Sale system, but note how they describe that they *weren't* able to interfere with anything handled by the secure processor: blog.stmcyber.com/pax-pos-cves...

blog.stmcyber.com

In this article, we present details of 6 vulnerabilities on the Android POS devices made by the worldwide known company PAX Technology.

270

The above is a stark, stark contrast to the classic magswipe POS machines with a simple magstripe reader attached to a general-purpose Windows host, which sent full swipe track data in the clear to it.

010

Theoretically possible, but any EMV POS has to meet PCI PIN Transaction Security (PTS), which means that it is effectively a tamper-responsive Hardware Security Module that happens to run an application to accept payments. Payments acceptance state machine is supposed to be on secure co-processor.

320

Minimal Version Selection Revisited

The subtle benefit of *minimal* version selection as a systemic damper on software supply chain attacks: "What’s more, the deeper in your dependency tree the library is, the more explicit approvals are required for the library to propagate to your project." matklad.github.io/2024/12/24/m...

matklad.github.io

In this post, I want to highlight one aspect of Go-style minimal version selection that I have missed completely at first. Maybe you missed it too?

071

It turns out that replacing the static payment authz tokens (PAN, CVV) with smartcards that generate non-replayable cryptographic payment authorization messages e2ee'd to the card issuer made infecting points of sale effectively useless.

160

Dino A. Dai Zovi @ddz.bsky.social · 23/12/2024

The transition from static long-term "credentials" (PAN + CVV) to EMV cryptograms generated by smartcards and the continuing transition for online payments are good case studies for how to devalue data to the point of making attacks on processing infra no longer worthwhile. Human authn must be next.

041

What "works" means for some categories of infosec products: EDR: detects a non-zero number of attacks, doesn't detect an unspecified number of other attacks IAM: provides users access to resources, and also provides it to an unspecified number of other users (possibly malicious) :)

120

Reposted by Dino A. Dai Zovi

Mike Masnick @masnick.com · 20/12/2024

Honestly, the Let's Encrypt folks don't get nearly enough credit for basically protecting the entire fucking internet, by making it absolute bog standard to encrypt everything. It happened so fast and so many people were skeptical.

151247277

Reposted by Dino A. Dai Zovi

Stéphane Taillat @staillat.bsky.social · 20/12/2024

An excellent episode on a topic on which I've given some thoughts in my book with similar conclusions: 1️⃣Targeting TikTok in the name of "national security" avoids addressing the structural problems of unregulated personal data and content moderation.

1155

The reason why things like algo won't work is that it trades your trackable home IP for a trackable cloud provider IP, which doesn't address privacy goals of not being trackable across different destination sites and visits across time.

010

One way to get this would be making the first tier a cloud node that you run which runs an Oblivious HTTP or MASQUE proxy (does not terminate TLS) and cycles cloud IPs periodically. The second tier would be a CDN (Cloudflare or Fastly) for performance and obscuring home IP, essentially.

100

I haven't really sketched it out yet, but the key principle to implement is information splitting by having two tiers. The first knows who you are (sees real IP or has account info), but not the destination of your traffic. The second does not know who you are, but does know destination of traffic.

110

Sometimes and most likely, yes. I have been meaning to set up some personal infra to do roughly the equivalent of iCloud Private Relay from Linux, but haven't gotten to it yet.

110